On Evaluating the Performance of Security Protocols